<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I have a weird problem. I have a bunch of sensors running in CentOS 6 with latest pf_ring and Suricata 2.1beta4.<div>Most of the sensors have HP fiber nics (10 gigs) for monitoring interfaces but two of them have Intel 82599 (ixgbe).</div><div>One of these Intel sensors is active and the other is standby. Standby barely has any traffic on monitored interface (about 400 packets a minute which are all broadcast).</div><div>When I start suricata service on the standby, it is impossible to reload rules or to stop it. On stop it eventually dies off with this message:</div><div><Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine unable to disable detect thread - "RxPFReth21". Killing engine</div><div><br></div><div>I've flipped the active and standby to check if the server/hardware is the problem. The issue moved to the other server when it became standby.</div><div><br></div><div>I've installed the latest Intel Driver. I've set everything on it as per article:</div><div><a href="http://pevma.blogspot.com/2013/12/suricata-and-grand-slam-of-open-source.html" target="_blank">http://pevma.blogspot.com/2013/12/suricata-and-grand-slam-of-open-source.html</a></div><div><br></div><div>I've tried killing irqbalance and setting affinity. No luck.</div><div>I did however noticed that if i reduce number of threads to 1, everything is working. But when it is more than one, the issue starts.</div><div><br></div><div>Did anybody else have this issue with Intel cards and PF_RING???</div> </div></body>
</html>